PRIVACY POLICY
Astana, 2026
Last revised: 15.04.2026
Effective as of publication on the Website
This Privacy Policy (the “Policy”) sets forth the procedure for the collection, use, storage, and protection of information received by “HolyPoly” LLP (Limited Liability Partnership) (the “Partnership”, the “Company”, the “Operator”) from individuals and legal entities (the “User”) when using the ScanWOW website, API, interfaces, software components and (if applicable) mobile application available at https://scanwow.com/ (the “Website”, the “Service”).
1. General Provisions
1.1. This Policy has been developed in accordance with the laws of the Republic of Kazakhstan, the internal and public documents of the Partnership, and also taking into account the requirements of applicable foreign law in cases where it applies to the processing of the User’s data (including GDPR and CCPA), as well as applicable international treaties to which the Republic of Kazakhstan is a party.
1.2. This document forms part of the ScanWOW Document Package and applies together with:
(i) ScanWOW Terms of Service (ToS);
(ii) Subscription Offer Agreement;
(iii) License Terms & Conditions and Appendices A1–A5;
(iv) Personal Data Collection and Processing Policy.
The order of priority of documents and special rules are established in the ToS; special provisions shall prevail over general provisions.
1.3. By using the Website, the User confirms their consent to this Policy and agrees to the collection and processing of their data in the manner and under the conditions set forth herein.
Where the processing of information and/or personal data is based on consent, the User provides such consent by using the Service and/or performing actions provided by the interface (registration, setting preferences, purchasing access, etc.), unless otherwise required by applicable law.
1.4. For the purposes of this Policy, the term “Confidential Information” refers to any information obtained by the Partnership from or about the User that:
1) Is not public, commonly known, or publicly available;
2) Constitutes their personal data;
3) Relates to the User’s payment information (e.g., card details, transaction numbers, etc.);
4) Represents the User’s commercial, banking, tax, or other legally protected secrets;
5) Pertains to the User’s purchases, preferences, and behavior on the Website;
6) Is recognized as such under the laws of the Republic of Kazakhstan and international treaties ratified by the Republic of Kazakhstan.
1.5. The Partnership does not verify the accuracy of the information received and/or collected about the User.
1.6. Certain sections of the Website, marked accordingly, are intended only for the Users aged eighteen (18) or older. The Partnership does not knowingly collect information about minors and does not verify the accuracy of data provided by the User on their profile page.
1.7. If there is reason to believe that Confidential Information was obtained from a person under eighteen (18), such data will be deleted upon the first request of their legal representative.
1.8. The terms of processing the User’s personal data (including categories of personal data, purposes, retention periods, the User’s rights and the procedure for their exercise) are defined in the Partnership’s “Personal Data Collection and Processing Policy” and shall apply together with this Policy. In case of any discrepancies on personal data matters, the “Personal Data Collection and Processing Policy” shall prevail.
2. Procedure for Ensuring the Security of Confidential Information
2.1. The collection, use, storage, and protection of Confidential Information shall be carried out in accordance with the following principles:
1) Respect for constitutional rights and freedoms of individuals (human and civil rights);
2) Lawfulness of the purposes and methods of processing Confidential Information and good faith;
3) Confidentiality of the information provided by the User;
4) Compliance of the purposes of processing Confidential Information with the purposes defined and declared at the time of collection;
5) Ensuring the security of Confidential Information and prohibiting the merging of databases containing such information if created for incompatible purposes.
2.2. The Partnership shall take all reasonable organizational, technical, and legal measures to protect Confidential Information from unauthorized access, use, disclosure, alteration, or destruction.
2.3. Access to Confidential Information shall be granted only to authorized employees of the Partnership who have undertaken obligations of non-disclosure.
2.4. The Partnership may disclose Confidential Information to third parties solely in the following cases:
— to payment and billing providers — to the extent necessary to accept and administer payments (payment card details are processed by such providers, while the Partnership may receive only technical and accounting payment data, including transaction identifiers);
— to the Partnership’s contractors and service providers (hosting, cloud infrastructure, support, analytics, mailings) — subject to confidentiality obligations and processing of data solely on the Partnership’s instructions;
— to governmental authorities — in cases and in the manner expressly provided by the laws of the Republic of Kazakhstan;
— with the User’s consent or on other lawful grounds provided by applicable law.
2.5. To ensure maximum security of Confidential Information, the Partnership shall:
1) Process only those records and documents containing Confidential Information to which it has obtained access through business relationships;
2) Maintain clear identification of specifically protected information;
3) Strictly adhere to handling procedures for all records and documents containing the User’s confidential information.
2.6. The Partnership shall process the Users' personal data including but not limited to the following grounds:
- User's consent (pursuant to Article 6(1)(a) GDPR);
- Necessity for performance of a contract (Article 6(1)(b) GDPR);
- Legitimate interests of the Partnership (Article 6(1)(f) GDPR), including service improvement and fraud prevention;
- Compliance with legal obligations (Article 6(1)(c) GDPR).
3. Periods of Storage of Confidential information
3.1. Confidential Information shall be stored no longer than necessary to achieve the purposes of processing, or for the periods established by the laws of the Republic of Kazakhstan.
3.2. Confidential Information shall be destroyed (deleted) upon the User’s request in cases where this is permitted by applicable law and does not prevent the Partnership from performing its obligations, or at the Partnership’s initiative upon achievement of the processing purposes and expiration of retention periods established by applicable law and the Partnership’s public documents.
4. Liability
4.1. The Partnership shall be liable for compliance with this Policy to the extent established by the laws of the Republic of Kazakhstan.
4.2. The User shall be responsible for the accuracy of provided information and the security of their account credentials.
4.3. The Partnership shall not be liable for network attacks, Website breaches, or failures caused by technical reasons and/or unlawful actions of third parties, provided that the Partnership has taken reasonable organizational and technical measures to protect information and ensure the security of the Service.
4.4. Any and all disputes regarding Confidential Information between the Partnership and User shall be resolved in the manner stipulated in the Partnership's approved public documents and in compliance with the laws of the Republic of Kazakhstan.
5. Final Provisions
5.1. This Policy shall take effect upon approval and Remain valid until officially revoked.
5.2. The Partnership reserves the right to unilaterally amend or supplement this Policy at any time by publishing updated versions on the Website.
5.3. For matters related to confidentiality and data processing, the User may submit an inquiry by email to: info@scanwow.com. The Partnership shall review inquiries within a reasonable time, taking into account the requirements of applicable law.